Safety system for aerial vehicles and method of operation

ABSTRACT

A safety system for an aerial vehicle, preferably including: a ballistic subsystem, preferably including one or more rockets operable to adjust motion of the aerial vehicle and a mounting unit that couples the ballistic subsystem to the aerial vehicle; and/or a deployable parachute subsystem. An aerial vehicle, preferably including a safety system. A method for aerial vehicle operation, preferably including activating a safety system.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation-in-part of U.S. patent applicationSer. No. 15/661,763, filed 27 Jul. 2017, which is a continuation of U.S.patent application Ser. No. 15/643,205, filed on 6 Jul. 2017, whichclaims the benefit of U.S. Provisional Application Ser. No. 62/452,051,filed on 30 Jan. 2017, and U.S. Provisional Application Ser. No.62/469,419, filed on 9 Mar. 2017, all of which are incorporated in theirentirety by this reference.

This application claims the benefit of U.S. Provisional Application Ser.No. 62/463,247, filed on 24 Feb. 2017, which is incorporated in itsentirety by this reference.

TECHNICAL FIELD

This invention relates generally to the field of aerial vehicles andmore specifically to a new and useful safety system for aerial vehicles.

BACKGROUND

The inventions described herein relate to systems and methods forincreasing the safety of aerial vehicles. In certain configurations,current aerial vehicles can be operated in a manner that trades kineticenergy for potential energy or potential energy for kinetic energy, inorder to recover from an unsafe situation or attitude. In one typicalscenario, altitude can be traded for airspeed, in order to recover froman emergency that occurs in a slow flight or a stalled configuration.

However, certain states of an aerial vehicle, where the total energy(e.g., kinetic and potential energies) available is below a threshold,can produce scenarios where flight recovery is impossible without damageto the aerial vehicle or to its occupants in the event of an emergency.An example of this is the “dead man's curve” for rotorcraft, whereemergencies in low airspeed and low altitude configurations produce anunrecoverable aerial vehicle state.

As such, there is a need in the field of aerial vehicles for a new anduseful safety system. The inventions described herein create such a newand useful safety system and method.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a schematic representation of an embodiment of a safety systemfor an aerial vehicle.

FIG. 2 is a schematic representation of a variation of a portion of asafety system.

FIG. 3 is a schematic representation of a variation of a portion of asafety system for an aerial vehicle.

FIGS. 4A and 4B depict variations of applications implementing a safetysystem for an aerial vehicle.

FIGS. 5A and 5B depict variations of a safety system for an aerialvehicle.

FIGS. 6A and 6B depict alternative variations of a safety system for anaerial vehicle.

FIG. 7 depicts an embodiment of an aerial vehicle with parachuteanchors.

FIGS. 8A and 8B depict specific examples of methods using a safetysystem for an aerial vehicle.

FIG. 9A depicts a flowchart representation of an embodiment of a methodof aerial vehicle operation.

FIG. 9B depicts a flowchart representation of an embodiment ofperforming emergency countermeasures.

DESCRIPTION OF THE EMBODIMENTS

The following description of the embodiments of the invention is notintended to limit the invention to these embodiments, but rather toenable any person skilled in the art to make and use this invention.

1. System.

As shown in FIG. 1, an embodiment of a safety system 100 for an aerialvehicle preferably includes: a ballistic subsystem 110 including one ormore rockets 115 operable to adjust motion of the aerial vehicle; and amounting unit 120 that couples the ballistic subsystem to the aerialvehicle. The system 100 can additionally or alternatively include adeployable parachute subsystem 130 coupled to a region of the aerialvehicle and operable to deploy a parachute 135; and a connector 140coupled to the parachute, to a first anchoring point 142 of the aerialvehicle, and to a second anchoring point 144 separated from the firstanchoring point of the aerial vehicle.

The system 100 preferably functions to provide one or more “last-resort”safety mechanisms for an aerial vehicle, implementing one or more of arocket-based approach and a ballistic parachute approach. In variations,the rocket and ballistic parachute system components can be deployedindependently of each other, and can be deployed in parallel, in series,or in any other suitable manner. Additionally or alternatively, thesystems described herein can supplement function of safety mechanismsintrinsic to the aerial vehicle. In examples, such safety mechanisms caninclude autorotation operations for rotorcraft and gliding operationsfor fixed-wing aircraft. Alternatively, some variations of the system100 can omit one of the rocket system and the ballistic parachutesystem.

In some variations, the system 100 can cooperate or coordinate withautonomous or semi-autonomous aerial vehicle systems that providereal-time information regarding the aerial vehicle's orientation,integrity of systems of the aerial vehicle (e.g., power plant integrity,control surface integrity, electrical system integrity, navigationsystem integrity, etc.), altitude, terrain, nearby obstacles, airspace,environmental conditions (e.g., density altitude, temperature,temperature/dewpoint spread, pressure, daylight, visibility, winds,etc.), and any other suitable information relevant to flight of theaerial vehicle. Such autonomous or semi-autonomous systems can be usedto trigger deployment of one or more of the rocket system and theballistic parachute system, as well as to continue controlling executionand coordination of such systems. Embodiments, variations, and examplesof such systems are described in U.S. application Ser. No. 15/661,763,titled “Vehicle System and Method for Providing Services”, which isherein incorporated in its entirety by this reference. However, thesystem 100 can additionally or alternatively cooperate with any othersuitable autonomous or semi-autonomous system. Still further, the system100 can alternatively be used in a non-autonomous manned aerial vehicle(e.g., aircraft carrying a human pilot) or remotely operated aerialvehicle (e.g., a drone).

In embodiments, the aerial vehicle can be a rotorcraft, such that thesystem 100 components are coupled to one or more portions of therotorcraft (e.g., the airframe of the rotorcraft, the fuselage of therotorcraft, etc.). For example, the rotorcraft can include any or allof: an airframe, a rotor rotationally coupled to the airframe about arotor axis, and/or a power plant (e.g., piston engine, turbine engine,etc.) configured to drive rotation of the rotor (e.g., mechanicallycoupled to the rotor by a power transmission, such as a driveshaft). Therotorcraft can optionally include multiple rotors, such as tandem rotors(e.g., with rotor axes at a small angle to each other, such assubstantially parallel and/or angle less than 1°, 5°, 10°, 15°, 30°,45°, 1-5°, 5-20°, 20-60°, etc.), or a main rotor and a tail rotor (e.g.,with a tail rotor axis substantially perpendicular the main rotor axis).However, the rotorcraft can additionally or alternatively include anyother suitable rotors and/or other elements in any suitable arrangement.

The aerial vehicle can alternatively be any other suitable aerialvehicle. For instance, in other embodiments, the aerial vehicle can bean aerial vehicle of any suitable category, class, or type, and inexamples can be one or more of: a fixed-wing aircraft, a gyrocraft(e.g., autogyro), a single engine aerial vehicle, a multi-engine aerialvehicle, a hybrid aerial vehicle including fixed-wing and rotorcomponents, an aerial vehicle with turbine components, an aerial vehiclewithout a power plant (e.g., a glider), a multi-terrain functionalaerial vehicle (e.g., a seaplane, an amphibious aerial vehicle, anaerial vehicle with skis, etc.), and any other suitable vehicle.

As such, in relation to coupling regions between the aerial vehicle andthe systems described herein, the aerial vehicle can have any suitableform factor for fuselage and/or airframe components, as described infurther detail below.

1.1 Ballistic Subsystem.

The ballistic subsystem 110 functions to affect one or more of theorientation, position, velocity vector, and acceleration (PVA) of theaerial vehicle. The rockets 115 of the ballistic subsystem 110 arepreferably a plurality of rocket engines (e.g., defining one or morerocket engine arrays), but can additionally or alternatively includeonly a single rocket engine and/or include any other suitable rocketelements. The rocket engines are preferably configured to remainattached to and exert force upon the aerial system during rocket enginefiring, but the ballistic subsystem 110 can additionally oralternatively include rockets that detach from the aerial system duringfiring, and/or include rocket elements configured in any other suitablemanner.

In some circumstances, if the aerial vehicle (or a subsystem thereof,such as the rotor) experiences power loss (e.g., complete power loss,partial power loss, etc.; such as resulting from power plant failure)and/or another catastrophic failure (e.g., mid-air collision), theballistic subsystem 110 can fire one or more rockets of its array ofrockets (e.g., retrorockets, any other suitable rockets) to reorientand/or decelerate the aerial vehicle prior to impacting the ground oranother object. As such, in relation to orientation, the ballisticsubsystem can fire one or more rockets with suitable thrust components(e.g., amplitude and direction) to affect the pitch, yaw, and/or roll ofthe aerial vehicle. In relation to PVA, the ballistic subsystem can fireone or more rockets with suitable thrust components (e.g., amplitude anddirection) to affect: position of the aerial vehicle in space (e.g., 2Dspace, 3D space), velocity of the aerial vehicle (e.g., velocity vectoramplitude, velocity vector direction, etc.), and/or acceleration of theaerial vehicle (e.g., acceleration amplitude, acceleration vectordirection, change in acceleration over time, etc.). In specificexamples, the ballistic subsystem 110 can be used to lift the aerialvehicle to an appropriate altitude for parachute deployment, prior toimpact, in relation to the deployable parachute subsystem 130 describedbelow. Additionally or alternatively, the ballistic subsystem 110 canreposition and/or change energy state of the aerial vehicle prior toimpact in any other suitable manner.

As shown in FIG. 1, the set of rockets 115 of the ballistic subsystem110 can be configured in an array and coupled as a unit to the airframeor fuselage of the aerial vehicle. As described in relation to themounting unit 120 below, the array can be configured to couple, by wayof the mounting unit 120, to the aerial vehicle, wherein forces causedby the rockets are directed, at least partially, through the mountingunit 120 as a structural component of the aerial vehicle. In variationswherein the set of rockets 115 is configured in an array, the array canbe a rectangular array, a polygonal array, an ellipsoid array, acircular array, an array following a surface morphology of the fuselageof the aerial vehicle, an amorphous array, and/or any other suitabletype of array.

Additionally or alternatively, as shown in FIG. 2, one or more of theset of rockets 115 of the ballistic subsystem 110 can be individuallypositioned at one or more regions of the aerial vehicle. As such, inthese variations, individual rockets of the set of rockets 115 can beconfigured to provide thrust in a manner that applies forces to specificindividual regions of the aerial vehicle. In variations wherein theaerial vehicle comprises separate portions (e.g., a cockpit region, aninstrument region, a sensor region, control surface regions, etc.), eachof the set of rockets 115 can be coupled to a corresponding separateportion of the aerial vehicle. In one example, involving couplingbetween individual rockets and portions of the aerial vehicle, one ormore of the set of rockets 115 can be operable to separate and propelcomponents of the aerial vehicle in different directions. In onespecific application, a subset of the set of rockets can be operable toseparate and jettison compromised portions of the aerial vehicle (e.g.,compartments of the aerial vehicle with inextinguishable flames) thatare not required for landing safely, while one or more other subsets ofthe set of rockets can be operable to cushion any impact of otherportions of the aerial vehicle (e.g., portions containing passengers,portions containing cargo, etc.) by reducing kinetic energy of thedamaged aerial vehicle prior to impact (e.g., by firing downward as theaerial vehicle approaches the ground, thereby reducing the aerialvehicle's downward velocity at impact).

The rockets are preferably arranged below a horizontal midplane of theaerial system (e.g., plane including a central reference point, such asthe aerial system center of gravity; plane normal a vertical referenceaxis, such as a rotor axis, axis normal the ground and/or parallel agravity vector when the aerial system is in a landed configuration fullysupported by the ground, etc.), such as being arranged in, on, and/orbelow a belly of the airframe. For example, in a rotorcraft including amain rotor above the airframe, the rockets can oppose the main rotoracross the horizontal midplane. However, any or all of the rockets canalternatively be arranged on and/or above the horizontal midplane.

However, the set of rockets 115 of the ballistic subsystem 110 canalternatively be configured in any other suitable manner.

The set of rockets 115 can include any suitable number of rockets (e.g.,1-10, 10-30, 30-50, 50-100, more than 100, etc.), and in specificexamples, can include between 10 and 30 rockets arranged as a clusterand/or coupled to different regions of the aerial vehicle. The rocketscan use any suitable propellant type (e.g., solid, liquid, gas, gel,etc.) and propellant quantity to provide suitable thrust characteristicsand duration for reducing kinetic energy of the damaged aerial vehicleprior to impact and/or for any other suitable application involvingsafety of the aerial vehicle. One or more of the rockets can optionallybe controlled (e.g., throttled) within a range of possible firingintensities (e.g., corresponding to different fuel burn rates); however,all or some of the rockets can alternatively be operable only between anon state and an off state. Each of the set of rockets 115 can be asingle-use rocket that is no longer useable after its propellant sourceis depleted; alternatively one or more of the set of rockets 115 can bea multi-use rocket that can be re-used (e.g., following replenishment ofits propellant). Still alternatively, one or more of the set of rockets115 can share a propellant source.

The rocket motors are preferably oriented such that each rocketpropulsion vector (e.g., representing a force exerted on the airframe bythe rocket motor) and/or a net propulsion vector (e.g., associated withthe set of all rocket motors or any suitable subset thereof) includes anupward component (e.g., oriented away from the ground when the aerialsystem is in a landed configuration fully supported by the ground;example shown in FIG. 2), such as the vector being within a thresholdangle of a vertical axis (e.g., substantially parallel, within 1°, 5°,10°, 15°, 30°, 45°, 1-5°, 5-20°, 20-60°, etc.). Preferably, a dotproduct of a propulsion vector (e.g., individual rocket enginepropulsion vector, net propulsion vector, etc.) and an upward referencevector (e.g., internal reference, such as a rotor vector directed alongthe rotor axis from the airframe or midplane to the rotor; externalreference, such as a vector opposite the gravity vector or aground-normal vector directed from the ground into the air; etc.) isgreater than zero. However, any or all of the rocket motors canalternatively include downward components, be substantially lateral(e.g., include only an insignificant vertical component), and/or haveany other suitable orientation.

The rocket motors of the set of rockets 115 can be fixed to one or moreof the fuselage or the airframe of the aerial vehicle, such that therockets of the set of rockets 115 are fixed in orientation relative tothe aerial vehicle. In variations of this configuration, activation ofdifferent combinations of the set of rockets 115 can produce any netforce vector with any suitable force magnitude and/or orientation (e.g.,within a range of net force vectors achievable by the system, selectedfrom a discrete set of achievable net force vectors, etc.), in order toaffect motion of the aerial vehicle. Additionally or alternatively, oneor more of the rockets can include a thrust vectoring module (e.g.,gimbaled rocket engine and/or nozzle, exhaust vanes, fluid injectionmodule, etc.). For example, motors of one or more of the set of rockets115 can be gimbaled to the fuselage or airframe, such that theorientation(s) of one or more of the set of rockets 115 can beindependently adjustable relative to the aerial vehicle. In variationsof this configuration, the gimbal(s) of the set of rockets 115 can beused to dynamically control the force vector produced by the set ofrockets 115 by changing relative angles between one or more rockets andthe fuselage of the aerial vehicle. In variations wherein the motors areactuatable, actuation can be controlled with electrical signals (e.g.,in a manner analogous to using full authority digital control systems),by mechanical subsystems for rocket motor actuation, and/or in any othersuitable manner. Furthermore, using either or combinations of bothconfigurations, real time control of a trajectory of the aerial vehiclecan be achieved by modulating one or more of: rocket force output, whichsubset of the set of rockets is activated, and orientation of rockets ofthe set of rockets.

The rockets can additionally or alternatively include one or more rocketmotors arranged on (e.g., affixed to) one or more rotor blades of theaerial system rotor (e.g., oriented substantially tangentially, such aswith propulsion vectors substantially normal the rotor axis), preferablyarranged at or near the rotor blade tips. These rotor blade rocketspreferably function to propel the rotor (e.g., increase rotor rotationabout the rotor axis), but can additionally or alternatively perform anyother suitable functions.

Furthermore, each of the set of rockets 115 is preferably activatedusing an autonomous system (e.g., control system), as described above,wherein the autonomous system is operable to use aerial vehicle state,orientation, and/or environmental conditions to control activation ofone or more of the set of rockets 115. For example, in the event thatthe aerial vehicle has sustained airframe and/or other structural damageprior to rocket activation, the autonomous system can acquire data fromsensors of the aerial vehicle that are indicative of vehicle state,orientation, and environmental conditions, in order to determine whichof the set of rockets should be activated, as well as how much thrustand for what duration thrust should be applied from the specificrockets. Additionally or alternatively, in another example, theautonomous system can be configured to apply at least one “test pulse”of thrust from one or more of the set of rockets (e.g., in order toassess changes in weight and balance of the aerial vehicle due todamage, to assess kinematic behavior of the aerial vehicle in currentenvironmental conditions, etc.). However, automation of activation ofthe set of rockets can additionally or alternatively be implemented inany other suitable manner.

The ballistic subsystem 110 with its set of rockets 115 preferablyincludes a “dead man's switch” configuration, such that the ballisticsubsystem 110 engages even if all other systems of the aerial vehicleare incapacitated. For example, in response to determining that othersystems of the aerial vehicle (e.g., all other systems; relevant controlsystems, such as systems responsible for controlling the ballisticsubsystem to activate; etc.) are incapacitated (e.g., based on loss ofconnectivity to the system instantaneously or for greater than athreshold period of time, such as 10 ms, 30 ms, 100 ms, 300 ms, 1 s, 3s, 10 s, 30 s, 100 s, 1-1000 ms, 1-1000 s, etc.; based on sensormeasurements indicative of damage to and/or destruction of the system;etc.). The ballistic subsystem 110 can additionally or alternatively beconfigured to engage in response to receiving an emergency input (e.g.,from an operator or passenger of the aerial system), such as in responseto detecting actuation of an emergency conditions input (e.g., switch,button, etc.). However, the ballistic subsystem 110 can alternatively beconfigured in any other suitable manner.

The mounting unit 120 couples the ballistic subsystem 110 to the aerialvehicle, and functions to provide robust coupling between the set ofrockets of the ballistic subsystem and the aerial vehicle. Additionallyor alternatively, the mounting unit 120 can provide releasable couplingbetween the ballistic subsystem 110 and the aerial vehicle, insituations where the option to reduce gross weight of the aerial vehicleis preferred, after the vehicle is on a safer trajectory by theballistic subsystem.

The mounting unit 120 can couple to a main structural support componentof the airframe or fuselage of the aerial vehicle. Additionally oralternatively, the mounting unit 120 can include one or more robustcomponents of the ballistic subsystem 110. In one such variation, rockettubes of the set of rockets, due to their wall thickness and materialcomposition, can be used as a structural support feature of the aerialvehicle. In a specific example, the engine mount (e.g., mounting thepower plant to the aerial vehicle) of the aerial vehicle can be directlycoupled to the cluster of the set of rockets or the mounting unit 120 ofthe set of rockets 115. In other examples, other components of theaerial vehicle can thus be mounted to rocket tubes or other regions ofthe set of rockets 115.

In variations of the system 100 comprising the mounting unit 120, themounting unit 120 can have a position that is laterally centered aboutthe center of gravity (CG) of the aerial vehicle (e.g., the CG of theaerial vehicle with or without the mounting unit; the CG of the aerialvehicle alone, the known or anticipated CG of the aerial vehicleincluding contents such as passengers and/or removable equipment, etc.).The position of the mounting unit 120 can have a position that isslightly forward of the CG; however, the mounting unit 120 canalternatively have any other suitable position forward or aft of the CGof the aerial vehicle. Still alternatively, the mounting unit 120 canhave any other suitable position relative to the CG of the aerialvehicle (laterally, or forward/aft). In variations wherein the set ofrockets 115 includes rockets distributed at different regions of theaerial vehicle, the system 100 can include a set of mounting unitsoperable to couple each rocket to the aerial vehicle (e.g., a separatemounting unit for each rocket engine, a separate mounting unit for eachregion in which rocket engines are mounted, etc.).

In a specific example, the ballistic subsystem 110 can comprise an arrayof rockets coupled to a rotorcraft (e.g., Mosquito model rotorcraftmanufactured by Innovator Technologies) by a mounting unit 120 coupledto the belly of the rotorcraft. The mounting unit 120 can be laterallycentered and slightly forward of the CG. However, the ballisticsubsystem 110 can alternatively be coupled to any other suitable aerialvehicle and/or be configured in any other suitable manner, as describedabove.

The ballistic subsystem 110 can, however, be configured in any othersuitable manner.

1.2 Parachute Subsystem.

In some variations, the system 100 can further include a deployableparachute subsystem 130 coupled to a region of the aerial vehicle andoperable to deploy a parachute 135 (e.g., as shown in FIG. 1). Thedeployable parachute subsystem 130 functions to provide a dragincreasing option that reduces kinetic energy of the aerial vehicle,adjusts the trajectory of the aerial vehicle (e.g., to less hazardouslanding sites), and/or adjusts the orientation of the aerial vehicle(e.g., to decrease anticipated impact damage to the aircraft and/orcontents, to enable and/or enhance use of other safety system elementssuch as the ballistic subsystem, etc.) prior to impact.

The parachute 135 (e.g., parachute canopy) of the deployable parachutesubsystem 130 can be radially symmetric (e.g., with a circularfootprint), or can alternatively be non-radially symmetric. Stillalternatively, the parachute 135 of the deployable parachute subsystem130 can have a lateral or longitudinal axis of symmetry (e.g., as in aram-air parachute and/or other wing-shaped parachute, such as arectangular or tapered canopy), such that the parachute 135 can besteerable relative to winds aloft. The parachute 135 is preferablycomposed of a synthetic material that is resistant to moisture,puncture, and/or UV damage; however, the parachute 135 can alternativelybe composed of any other suitable material. The deployable parachutesubsystem 130 can optionally include one or more pilot chutes (e.g., apilot chute coupled to each parachute 135). The deployable parachutesubsystem 130 can additionally or alternatively comprise any suitablenumber of parachutes.

The deployable parachute subsystem 130 can be operable to deploy theparachute 135 using passing airflow, after releasing a portion of theparachute 135 in a manner that interacts with relative wind and theaerial vehicle. Additionally or alternatively, the deployable parachutesubsystem 130 can include electrical and/or mechanical means forparachute deployment. In one such variation, the deployable parachutesubsystem 130 can comprise one or more rockets, such as rockets thatpropel the parachute from the aerial vehicle using electrical signals(e.g., in a manner analogous to using full authority digital controlsystems) and/or by mechanical subsystems for rocket activation.

In variations wherein the parachute 135 is deployed, at least in part,using one or more rockets, the rocket(s) can be directly mounted to theparachute 135, or can alternatively be tethered (or otherwise connected)to the parachute 135 (e.g., as shown in FIG. 3), such that activation ofthe rocket leads the parachute 135 along a trajectory and/or a sustainedposition relative to aerial vehicle, thereby pulling the parachute 135in tow. Use of a tethering system can thus promote proper deployment ina manner that promotes reliable opening of the parachute 135. In someembodiments, the connector (e.g., tether) is sufficiently long that theparachute does not substantially affect airflow near the aerial system(e.g., near the rotor, such as airflow driving and/or driven by therotor); however, the parachute subsystem can additionally oralternatively include a connector of any suitable length, and/or cancouple the parachute to the other elements of the aerial system in anyother suitable manner. Additionally or alternatively, an autonomoussystem associated with systems of the aerial vehicle can be used togovern a trajectory of the parachute, by way of the rocket(s), basedupon one or more of: present trajectory of the aerial vehicle, predictedtrajectory of the aerial vehicle, wind factors (at altitudes alongtrajectory), structural integrity of the aerial vehicle, capabilities ofthe aerial vehicle propulsion system, and any other suitable factor.However, the parachute 135 can be deployed from the aerial vehicle 135in any other suitable manner.

Similar to operations described in relation to the ballistic subsystem110 above, rockets coupled to the parachute 135 (e.g., by directmounting, by tethering, etc.) can be used to lift the aerial vehicle toan appropriate altitude (e.g., in promoting parachute deployment) priorto impact, such that the parachute 135 has adequate altitude and/or timeto appropriately reduce the kinetic energy of the aerial vehicle priorto impact. In one such variation, once a tether coupled to the parachute135 is fully extended, rocket forces directly exerted on the parachute135 and the aerial vehicle can be used to: reduce and/or increase thevelocity (e.g., downward velocity component, upward velocity component,one or more lateral velocity components, overall velocity, etc.) of theaerial vehicle rapidly and/or increase the altitude of the aerialvehicle such that the parachute 135 can fully inflate and providesufficient drag to bring the aerial vehicle down safely. In specificexamples, the rocket forces can be used to: decrease aerial vehicledownward velocity (e.g., prior to ground impact, such as immediatelyprior to landing; working in concert with and/or independently from theparachute), increase aerial vehicle upward velocity, change aerialvehicle vertical velocity from downward to upward, increase aerialvehicle lateral velocity, decrease aerial vehicle lateral velocity,change aerial vehicle lateral velocity direction, and/or change aerialvehicle velocity in any other suitable manner. Additionally oralternatively, the parachute 135 and/or rockets associated with (e.g.,attached to, such as tethered to or attached directly to) the parachutecan reposition, reorient, and/or change energy state of the aerialvehicle prior to impact in any other suitable manner.

Additionally or alternatively (e.g., in variations wherein thedeployable parachute subsystem 130 is actively deployed), the deployableparachute subsystem 130 can include a “dead man's switch” configuration(e.g., as described above regarding a “dead man's switch” of theballistic subsystem; a single “dead man's switch” shared by theparachute subsystem and ballistic subsystem, identical or similar to butindependent of the ballistic subsystem “dead man's switch”, differentthan the ballistic subsystem “dead man's switch”, etc.), such that thedeployable parachute subsystem 130 engages even if all other systems ofthe aerial vehicle are incapacitated. However, the deployable parachutesubsystem 130 can alternatively be configured in any other suitablemanner.

As indicated above, the ballistic subsystem 110 and the deployableparachute subsystem 130 can be activated independently of each other. Inone example scenario, where the aerial vehicle is a rotorcraft that hasexperienced power loss without structural failure or controlmalfunction, the aerial vehicle can implement (e.g., using theautonomous system), a combination of autorotation and rocket firing fromthe ballistic subsystem 110, in order to land safely, as shown in FIG.4A. In another example scenario, where the aerial vehicle is arotorcraft that has experienced structural failure and/or controlmalfunction, the aerial vehicle can implement (e.g., using theautonomous system), a combination of parachute deployment and rocketfiring from the ballistic subsystem 110, in order to land safely, asshown in FIG. 4B. As such, in these scenarios and other scenarios,activating of one or both the ballistic subsystem 110 and the deployableparachute subsystem 130 can be used to ensure safety at any altitude,attitude, and airspeed, including zero airspeed/zero altitudesituations.

The system 100 can include one or more elements for actuator integrationredundancy. As such, should one actuator fail to move due to binding,signal loss, or any other failure mechanism, an alternative controlaffector can be engaged to perform the same function as the failedactuator. The alternative control affector(s) can be placed in parallelwith the primary control affector. In a specific example, if a firstactuator fails, a breakaway system (e.g., shear pin, giveaway system,etc.) can be used to disengage the first actuator and/or to allow aredundant functioning actuator to overrule the first actuator. Inrelation to actuator redundancy, should all actuators fail (or in anyother suitable circumstances), the system 100 can additionally oralternatively include a configuration for disengagement of the redundantsystem, thereby allowing a passenger or other entity (e.g., remoteoperator) to assume control of the aerial vehicle systems. However, thesystem 100 can alternative omit redundant actuator systems.

1.3 Additional Safety Features.

As noted above, the deployable parachute system 130 can additionally oralternatively include a connector 140 coupling the parachute 135 to afirst anchoring point 142 of the aerial vehicle. The deployableparachute system 130 can additionally be coupled to a second anchoringpoint 144 separated from the first anchoring point of the aerial vehicle(or to any other suitable number of additional anchoring pointsseparated from each other). The deployable parachute system can becoupled to both the first and second anchoring points by a singleconnector element (e.g., a connector element such as a tether runningfrom the parachute 135 to the first anchoring point 142 and then fromthe first anchoring point 142 to the second anchoring point 144, such asshown in FIGS. 1 and/or 5A), by separate connector elements (e.g., afirst connector element such as a first tether running from theparachute 135 to the first anchoring point 142, and a second connectorelement such as a second tether running from the parachute 135 to thesecond anchoring point 144, such as shown in FIG. 6A), and/or in anyother suitable manner.

The use of multiple anchoring points (e.g., first and second anchoringpoint) can result in the deployed parachute exerting different torques(e.g., torques of different direction and/or magnitude) on the aerialsystem and/or biasing the aerial system toward different orientations(e.g., level, pitched downward, pitched upward, etc.), depending on howthe parachute is anchored (e.g., by the first anchoring point, by thesecond anchoring point, by both anchoring points, etc.). The first andsecond anchoring points are preferably arranged such that asubstantially non-zero angle is defined between the first anchor momentarm (e.g., vector from a reference origin, such as the CG, to the firstanchoring point 142) and the second anchor moment arm (e.g., vector fromthe reference origin to the second anchoring point 144), such as shownin FIG. 7. For example, the angle between the moment vectors can begreater than a minimum threshold angle (e.g., 1°, 5°, 10°, 15°, 30°,45°, 60°, 80°, 90°, 100°, 120°, 1-15°, 15°-45°, 45-120°, etc.) and/orless than or equal to a maximum threshold angle (e.g., 1°, 5°, 10°, 15°,30°, 45°, 60°, 80°, 90°, 100°, 120°, 1-15°, 15°-45°, 45-120°, etc.).However, the moment vectors can alternatively define any other suitableangle. In variations, the first anchoring point 142 can be distant froma center of gravity (CG) and/or longitudinal midplane (e.g., planeincluding a vertical axis, such as the rotor axis, and a pitch axisthrough the CG) of the aerial vehicle, and the second anchoring point144 can be closer to the CG and/or vertical midplane of the aerialvehicle (e.g., for a rotorcraft with movable blades). For example, themagnitude of a cross product of the first moment arm with a rotor vector(e.g., directed along the rotor axis from the airframe or horizontalmidplane to the rotor) can be greater than the magnitude of a crossproduct of the second moment arm with the rotor vector (e.g., greater bya threshold amount, such as 10%, 25%, 50%, 100%, 150%, 200%, 250%, 300%,500%, 1000%, etc.). The connector 140 preferably functions to allow forparachute deployment in a manner that does not adversely interfere withrotors or other moving components of the aerial vehicle. For instance,while a rotor of an aerial vehicle is moving (but not autorotating),forces generated by the rotor can suck a deployed parachute into bladesof the rotor in an undesirable manner (e.g., causing entanglement,parachute and/or rotor damage, etc.). Thus, the connector 140 canpreferably prevent this scenario and/or other undesirable scenarios.

At least one of the first anchoring point 142 and the second anchoringpoint 144 of the connector 140 can be releasable, such that one or moreregions of the connector 140 (and/or one or more connector elements) canbe selectively uncoupled from the aerial vehicle during use of a safetymechanism involving the parachute 135. In a first variation, the firstanchoring point 142 can be positioned proximal the region of parachutedeployment, preferably such that the parachute is deployed away frommoving components of the aerial vehicle and maintained away from themoving components by the first anchoring point 142 (e.g., as shown inFIGS. 1 and/or 5A). In a specific example, the system 100 can thusinclude a tail-launched parachute with a fixed first anchoring point ata tail-region of a rotorcraft. However, the fixed first anchoring can beconfigured in any other suitable manner.

Additionally (e.g., as shown in FIGS. 5B and/or 6B), the first anchoringpoint 142 (and/or, in variations including multiple connector elements,a connector element coupled to the first anchoring point) can bereleased, thereby separating the connector 140 from the aerial vehicleat the first anchoring point 142. In examples, the first anchoring point142 can be released once (e.g., in response to, such as immediatelyafter or a threshold time interval after) oscillations associated withparachute deployment and/or wind effects have been suitably reduced,once the rotor state is acceptable for first anchoring point release(e.g., after rotor rotation speed has fallen below a threshold value),and/or once any other suitable criteria have been met. Additionally oralternatively, release of the first anchoring point 142 can becontrolled by the autonomous system described above. The releasemechanism can be mechanically driven, hydraulically driven, electricallydriven (e.g., electrically-activated explosive release mechanism,piezoelectric release mechanism, etc.), and/or driven in any othersuitable manner.

As such, once the first anchoring point 142 has been released, thesecond anchoring point 144 can be used to reorient the aerial vehicle inspace, preferably in a manner that puts occupants of the aerial vehicleapproximately upright again (e.g., as shown in FIGS. 5B and/or 6B).However, some variations of the system 100 can alternatively omitrelease of the first anchoring point 142 (e.g., in variations whereinthe cabin containing occupants can rotate within the fuselage to adjustorientation of the occupants in space relative to the aerial vehicle.

In some variations, as indicated above, the second anchoring point 144(and/or any other anchoring points) can also be releasable from theaerial vehicle, in order to release the parachute entirely away from theaerial vehicle when desired and/or to promote safety. In one example,release of all anchoring points between the parachute 135 and the aerialvehicle can be used to separate the parachute 135 prior to landing, suchthat the parachute does not interfere with exit of the occupants fromthe aerial vehicle. In a more specific example (e.g., as depicted inFIG. 8A), in the event of a forced water landing and/or if a portion ofthe aerial vehicle is on fire/smoking, the parachute can be entirelyreleased from the aerial vehicle, by the first and second anchoringpoints 142, 144 once the aerial vehicle has sufficiently slowed downprior to impact. The parachute 135 can thus move away from the aerialvehicle and allow occupants to exit without interference. In relation tothis feature, rockets coupled to the parachute can be used to activelydeliver the parachute 135 away from the aerial vehicle after theparachute is released, as shown in FIG. 8B, thereby further promotingnon-interference with exit of the occupants.

While the first anchoring point 142 is preferably away from the centerof gravity and/or moving components of the aerial vehicle, and thesecond anchoring point 144 is preferably near the center of gravity(e.g., to put occupants upright again), the first and/or the secondanchoring points 142, 144 can additionally or alternatively bepositioned anywhere else relative to the aerial vehicle.

2. Method.

A method 200 for aerial system operation preferably includes performingemergency countermeasures S230, and can additionally or alternativelyinclude operating the aerial vehicle in a nominal flight mode S210,determining an emergency condition S220, and/or any other suitableelements (e.g., as shown in FIG. 9A). The method 200 is preferablyperformed with an aerial vehicle including a safety system 100 (e.g., asdescribed above), but can additionally or alternatively be performedusing any other suitable systems.

Operating in a nominal flight mode S210 (e.g., as described in U.S.application Ser. No. 15/661,763, titled “Vehicle System and Method forProviding Services”, which is herein incorporated in its entirety bythis reference) preferably functions to control the aerial vehicleduring normal flight operations. In variations in which the aerialvehicle is a rotorcraft, S210 preferably includes controlling one ormore rotors of the rotorcraft to rotate about their respective rotoraxes (e.g., controlling a power plant of the rotorcraft to drive rotorrotation).

During performance of S210, the aerial vehicle preferably maintains itsorientation within a nominal orientation envelope. For example, thevehicle pitch can take on values within a threshold range from 0 (e.g.,no more than a threshold pitch, such as positive and/or negative 10°,15°, 20°, 25°, 30°, 35°, 40°, 5-20°, 20-60°, etc.) and/or from a nominalpitch value (e.g., 0°; positive or negative 1°, 2°, 3°, 5°, 7.5°, 10°,12.5°, 15°, 20°, 25°, 30°, 0-3°, 3-15°, 15-45°, etc.). The vehicle pitchis preferably a signed angle (e.g., wherein negative values are downwardpitches in which the vehicle front drops downward, and positive valuesare upward pitches in which the vehicle front rises upward) betweenprojections, onto a longitudinal midplane, of a central axis (e.g.,defined by the aerial vehicle) and an external vertical reference (e.g.,gravity vector), such as shown in FIG. 5A. The central axis can be arotor axis, a vehicle vertical reference axis (e.g., when the aerialvehicle is fully supported by the ground, an axis parallel a gravityvector and/or normal the ground supporting the vehicle). Thelongitudinal midplane preferably includes the CG and is preferablynormal a vehicle pitch axis. However, the pitch can alternatively bedefined in any other suitable manner.

Determining an emergency condition S220 preferably functions todetermine that the aerial vehicle has exited (and/or may exit) nominalflight conditions (e.g., that an off-nominal and/or undesired event hasoccurred or may occur).

Such events can include collisions (e.g., with terrain, with traffic,etc.), loss and/or degradation of aerial vehicle control, and/or anyother suitable events. In specific examples, the emergency conditionscan include: power plant failure (e.g., partial or total power loss; atany time, while operating a rotorcraft inside a dangerous region of thealtitude-velocity “dead man's” curve, etc.); flight control surfacefailure (e.g., surface damage and/or destruction, actuator failure,etc.); an aircraft position, orientation, and/or velocity outside anominal operation envelope (e.g., pitch and/or roll greater than athreshold value, such as 10°, 20°, 25°, 30°, 35°, 40°, 45°, 5-20°,20-60°, etc.; rapid altitude loss; etc.); dangerous airflow conditions(e.g., vortex ring state); and/or any other suitable conditions.

S220 can be performed based on measurements sampled by aircraft sensors,based on external information (e.g., remote sensor measurements, trafficwarnings, etc.) such as information received at the aircraft via radio,and/or any other suitable information. S220 is preferably performed bythe aircraft (e.g., by an autonomous aircraft control system; by a humanoccupant, such as a pilot, crew member, or passenger; etc.). However,S220 can additionally or alternatively be performed by a remote system(e.g., remote operator and/or control center, air traffic controller,etc.) and/or any other suitable entities; wherein the remote systempreferably sends an indication of the emergency condition to theaircraft (e.g., via radio transmission) in response to determination.

Performing emergency countermeasures S230 preferably functions torecover from and/or compensate for emergency conditions. S230 ispreferably performed in response to determining an emergency conditionS220 (e.g., immediately in response), but can additionally oralternatively be performed at any other suitable time. S230 can beperformed autonomously, by local and/or remote operators (e.g., pilot,crew, passenger, etc.), and/or by any other suitable entities. As shownin FIG. 9B, S230 preferably includes activating one or more aspects ofthe aerial vehicle safety system (e.g., as described above regarding thesafety system 100), such as the deployable parachute subsystem,ballistic subsystem, and/or any other suitable elements of the safetysystem. S230 can additionally or alternatively include landing theaerial vehicle and/or returning to nominal aerial vehicle operationfollowing resolution of the emergency condition (e.g., as described inU.S. application Ser. No. 15/661,763, titled “Vehicle System and Methodfor Providing Services”, which is herein incorporated in its entirety bythis reference).

Activating the deployable parachute subsystem preferably includesdeploying the parachute. Deploying the parachute can optionally includepropelling the parachute away from the airframe (e.g., using apropellant such as a spring, rocket engine connected to the parachute,etc.). Additionally or alternatively, ambient airflow can be used todeploy the parachute (e.g., wherein the parachute is released from aparachute storage element, thereby allowing ambient airflow to unfurlthe parachute and/or carry the parachute away from the airframe).

In variations that include multiple parachute anchoring modes (e.g., asdescribed above regarding multiple anchoring points), the parachute ispreferably deployed into a first anchoring mode, wherein the parachuteexerts force and/or torque on the airframe with a first moment arm(e.g., at a first anchor point), thereby causing the aircraft to assumea first anchoring mode orientation (e.g., for a tail-mounted firstanchor, facing substantially downward, such as shown in FIGS. 5A and/or6A; for a forward-mounted first anchor, facing substantially upward). Inthis orientation, the aerial vehicle pitch (and/or difference in pitchfrom a nominal pitch) is preferably greater than a threshold value(e.g., 10°, 15°, 17.5°, 20°, 22.5°, 25°, 27.5°, 30°, 35°, 40°, 45°,5-20°, 20-60°, etc.), but can alternatively be any suitable pitch. Sucha pitch can function to prevent entanglement of the parachute and/orparachute connector with the rotor (e.g., while the rotor is spinning athigh speed, such as close to normal operation speed)

In such variations, activating the deployable parachute subsystempreferably includes include transitioning the parachute betweenanchoring modes (e.g., from the first anchoring mode to a secondanchoring mode). The parachute is preferably transitioned in response todetermination of a transition trigger (e.g., satisfaction of a parachutesafety criterion). For example, the parachute can be transitioned inresponse to determining that rotor rotation has slowed below a thresholdrate (e.g., 1000 rpm, 500 rpm, 200 rpm, 100 rpm, 75 rpm, 50 rpm, 30 rpm,20 rpm, 0-10 rpm, 10-50 rpm, 50-250 rpm, etc.), preferably such that therisk of rotor interference with the parachute module (e.g., by causingairflow to pull the parachute into the rotor) is sufficiently low.

Transitioning the parachute between anchoring modes (e.g., into thesecond mode) preferably includes releasing the connection between thefirst anchor (or set of anchors) and the parachute. Following release ofthe connection, the parachute exerts force and/or torque on the airframewith a second moment arm (e.g., at a second anchor point), therebycausing the aircraft to assume a second anchoring mode orientation(e.g., preferably a substantially level orientation, such as shown inFIGS. 5B and/or 6B). In this orientation, the aerial vehicle pitch(and/or difference in pitch from a nominal pitch) is preferably lessthan a threshold value (e.g., 0°, 1°, 2°, 3°, 5°, 7.5°, 10°, 15°, 17.50,20°, 22.5°, 25°, 27.5°, 30°, 35°, 40°, 45°, 5-20°, 20-60°, etc.), butcan alternatively be any suitable pitch. Transitioning to the secondanchoring mode orientation can function to increase occupant comfortand/or ease of egress following vehicle landing (e.g., wherein occupantsare returned to a substantially upright orientation in the secondanchoring mode), increase landing safety (e.g., enabling a normallanding on aircraft wheels and/or skids), and/or have any other suitablefunction.

Activating the deployable parachute subsystem can additionally oralternatively include decoupling (e.g., disconnecting) the parachutefrom the airframe. For example, the parachute can be decoupled inresponse to aerial vehicle landing and/or soon before landing, inresponse to parachute entanglement, and/or at any other suitable time.Decoupling the parachute preferably includes disconnecting any parachuteanchors that are still connected to the parachute connector (e.g., thesecond anchor), and can optionally include propelling the parachute awayfrom the airframe (e.g., using a rocket engine coupled to the parachute,such as shown in FIG. 8B). However, activating the deployable parachutesubsystem can additionally or alternatively include any other suitableelements performed in any suitable manner.

Activating the ballistic submodule preferably includes exerting a forceon the airframe (e.g., by firing one or more of the rocket engines). Theforce exerted is preferably an upward force (e.g., a force including acomponent opposing gravity), and can be exerted by firingdownward-facing rocket engines (e.g., engines oriented substantiallyvertically, non-vertical engines generating propulsive force with anupward component, etc.) but can additionally or alternatively includeany other suitable forces (e.g., exerted by firing rocket engines withother orientations). Activating the ballistic submodule can function toalter aerial vehicle position, orientation, and/or velocity, preferablyto aid or enable safe aerial vehicle landing.

The ballistic submodule can optionally be used to increase the aerialvehicle altitude (e.g., distance above sea level, distance aboveterrain, etc.), such as to increase available time to effect a safelanding (e.g., if the emergency condition, such as power plant failure,occurs while operating at an airspeed and velocity inside or near the“dead man's” curve). In some embodiments, after increasing aerialvehicle altitude, aerial vehicle descent (and preferably landing) can becontrolled by performing an autorotation maneuver, by activating thedeployable parachute module, and/or in any other suitable manner. Therocket firing is preferably discontinued (or reduced in intensity, suchas to slow descent and/or help control vehicle orientation) during suchcontrolled descent, but can alternatively be sustained and/or controlledat any other suitable intensity. Additionally or alternatively, nominalflight can be resumed (e.g., as described above regarding S210)following ballistic submodule activation (e.g., wherein the additionaltime allowed by the increased altitude enables recovery of temporarilymalfunctioning vehicle systems, such as the power plant).

The ballistic submodule can additionally or alternatively be used todecrease the aerial vehicle downward velocity (e.g., velocity componentaligned with gravity). The downward velocity is preferably reduced soonbefore and/or during the landing process (e.g., wherein the ballisticsubmodule is used in concert with the parachute and/or rotor, such as inautorotation, to achieve safe landing; wherein the ballistic submoduleis used alone to achieve safe landing; etc.), but can additionally oralternatively be reduced at any other suitable time. In a first example,rockets are fired to reduce downward velocity after the parachute hastransitioned to the second anchoring mode (e.g., wherein the aerialvehicle has achieved a substantially level orientation). In a secondexample, rockets are fired to reduce downward velocity after theparachute has been disconnected from the airframe. In a third example,in which the rotorcraft descends using an autorotation maneuver, rocketsare fired to reduce downward velocity soon before landing (e.g., withina threshold distance above the ground, such as 10 ft, 25 ft, 40 ft, 50ft, 60 ft, 75 ft, 100 ft, 150 ft, 200 ft, 10-35 ft, 35-65 ft, 65-100 ft,100-300 ft, etc.), such as in place of or supplementing the landingflare of a typical autorotation landing maneuver.

The ballistic submodule can additionally or alternatively be used toavoid an imminent collision (e.g., with another aircraft), such as insituations in which the aerial vehicle is functioning nominally (e.g.,no power plant and/or control surface malfunctions) but may not besufficiently maneuverable to avoid the collision (e.g., usingtraditional flight controls alone). For example, the traditional flightcontrols (e.g., power plant and/or control surfaces) and the ballisticsubmodule can be used together (or alternatively, the ballisticsubmodule can be used alone) to achieve a rapid position and/or velocitychange, thereby avoiding the collision (e.g., after which, the aerialvehicle can resume nominal flight, such as described above regardingS210).

Activating the ballistic submodule preferably includes determining theaerial vehicle orientation (e.g., before, during, and/or after rocketengine firing), such as based on aerial vehicle sensors (e.g.,accelerometer, gyroscope, magnetometer, camera, radar, etc.). In a firstvariation, the rocket engines are not used to exert significant upwardforce on the vehicle (e.g., are not fired at all; are fired only orprimarily to effect vehicle orientation changes, such as describedbelow; etc.) until the vehicle is within an acceptable orientation range(e.g., pitch and/or roll within the nominal flight orientation range,within a threshold range of 0, such as within 2°, 5°, 10°, 15°, 17.50,20°, 22.5°, 25°, 27.5°, 30°, 35°, 40°, 45°, 2-10°, 10-25°, 25-35°,35-45°, etc.). Activating the ballistic submodule can optionally includealtering the aerial vehicle orientation (e.g., to achieve an orientationwithin the acceptable range, such as a substantially level or uprightorientation), such as by using rocket engines (e.g., selectively firinga subset of the engines and/or vectoring the engine thrust, therebyexerting a torque about the CG in order to effect vehicle rotation)and/or flight control surfaces to alter the vehicle orientation.However, vehicle orientation can additionally or alternatively bedetermined, monitored, and/or altered in any other suitable manner, andthe rocket engines can be fired under any other suitable conditions.

S230 can optionally include landing the aerial vehicle (e.g., asdescribed in U.S. application Ser. No. 15/661,763, titled “VehicleSystem and Method for Providing Services”, which is herein incorporatedin its entirety by this reference). The vehicle can be landed usingtypical flight controls (e.g., using unpowered and/or underpoweredmaneuvers, such as autorotation and/or gliding; using powered maneuvers;etc.), landed using one or more aspects of the safety system (e.g.,rocket engines, parachute, etc.), such as described above, and/or landedin any other suitable manner. The aerial vehicle is preferably landed assoon as practical following determination of the emergency conditionand/or activation of the safety system aspect(s), such as performing asafe landing maneuver as soon as possible and/or performing a landingmaneuver in the safest practical manner (or in a manner for which therisk of damage, such as damage to the aircraft, occupants, and/orsurroundings, is less than a safety threshold). However, the aerialvehicle can alternatively be landed with any other suitable timing.

Alternatively (e.g., wherein normal aerial vehicle system functions areregained), following S230, the aerial vehicle can resume nominal flightoperation (e.g., as described above regarding S210) and/or operation inany other suitable flight mode.

However, the method 200 can additionally or alternatively include anyother suitable elements performed in any suitable manner.

The methods and/or systems of the invention can be embodied and/orimplemented at least in part in the cloud and/or as a machine configuredto receive a computer-readable medium storing computer-readableinstructions. The instructions can be executed by computer-executablecomponents integrated with the application, applet, host, server,network, website, communication service, communication interface,hardware/firmware/software elements of a user computer or mobile device,or any suitable combination thereof. Other systems and methods of theembodiments can be embodied and/or implemented at least in part as amachine configured to receive a computer-readable medium storingcomputer-readable instructions. The instructions can be executed bycomputer-executable components integrated by computer-executablecomponents integrated with apparatuses and networks of the typedescribed above. The computer-readable medium can be stored on anysuitable computer readable media such as RAMs, ROMs, flash memory,EEPROMs, optical devices (CD or DVD), hard drives, floppy drives, or anysuitable device. The computer-executable component can be a processor,though any suitable dedicated hardware device can (alternatively oradditionally) execute the instructions.

The FIGURES illustrate the architecture, functionality and operation ofpossible implementations of systems, methods and computer programproducts according to preferred embodiments, example configurations, andvariations thereof. In this regard, each block in the flowchart or blockdiagrams may represent a module, segment, step, or portion of code,which comprises one or more executable instructions for implementing thespecified logical function(s). It should also be noted that, in somealternative implementations, the functions noted in the block can occurout of the order noted in the FIGURES. For example, two blocks shown insuccession may, in fact, be executed substantially concurrently, or theblocks may sometimes be executed in the reverse order, depending uponthe functionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts, or combinations of special purpose hardware andcomputer instructions.

As a person skilled in the art will recognize from the previous detaileddescription and from the figures and claims, modifications and changescan be made to the embodiments of the invention without departing fromthe scope of this invention as defined in the following claims.

We claim:
 1. A rotorcraft comprising: an airframe; a rotor rotationallycoupled to the airframe about a rotor axis; and a parachute modulecomprising: a parachute; an anchor submodule comprising a first anchorconnected to the airframe at a first point and a second anchor connectedto the airframe at a second point; and a parachute connectormechanically coupling the parachute to the anchor submodule; wherein thefirst anchor is operable to transition from an anchoring mode to areleased mode, wherein: in the anchoring mode, the parachute connectoris connected to the first anchor and a parachute force is exerted on thefirst anchor by the parachute connector; and in the released mode, theparachute connector is disconnected from the first anchor and connectedto the second anchor.
 2. The rotorcraft of claim 1, wherein theparachute module further comprises a parachute rocket engine coupled tothe parachute and configured to propel the parachute away from theairframe.
 3. The rotorcraft of claim 1, wherein: the parachute connectorcomprises a tether defining a first end connected to the parachute and asecond end connected to the second anchor; and in the anchoring mode,the first anchor is connected to the parachute connector between thefirst and second ends.
 4. The rotorcraft of claim 1, wherein: therotorcraft defines: a center of gravity (CG); a rotor vector directedalong the rotor axis from the airframe to the rotor; a first moment armfrom the CG to the first point; and a second moment arm from the CG tothe second point; and the magnitude of a first cross product of therotor vector and the first moment arm is greater than the magnitude of asecond cross product of the rotor vector and the second moment arm. 5.The rotorcraft of claim 4, further comprising a rocket enginemechanically connected to the airframe, wherein: the rocket enginedefines a propulsion vector; and a dot product of the propulsion vectorand the second moment arm is greater than zero.
 6. The rotorcraft ofclaim 1, further comprising a second rotor rotationally coupled to theairframe about a second rotor axis, wherein: the first point is closerto the second rotor axis than to the CG; and the second point is closerto the CG than to the second rotor axis.
 7. The rotorcraft of claim 6,wherein the first point is distal the CG from the second rotor axis. 8.The rotorcraft of claim 7, wherein the second rotor axis issubstantially perpendicular the rotor axis.
 9. The rotorcraft of claim1, further comprising a rocket engine mechanically connected to theairframe.
 10. The rotorcraft of claim 9, wherein: the rotorcraftdefines: a center of gravity (CG); and a midplane normal the rotor axis,the midplane comprising the CG; and the rocket engine opposes the rotoracross the midplane.
 11. A method for rotorcraft operation, comprising:at a rotorcraft comprising an airframe, a rotor rotationally coupled tothe airframe about a rotor axis, and a parachute mechanically coupled tothe airframe: operating the rotorcraft in a nominal flight mode,comprising controlling the rotor to rotate about the rotor axis; afteroperating the rotorcraft in the nominal flight mode, determining anemergency condition associated with the rotorcraft; and in response todetermining the emergency condition, at the rotorcraft, performingemergency countermeasures, comprising: deploying the parachute in afirst parachute anchoring mode, wherein the parachute exerts, on theairframe, a first force with a first moment arm defined from a center ofgravity (CG) of the rotorcraft; after deploying the parachute,determining a parachute mode transition trigger; in response todetermining the parachute mode transition trigger, controlling theparachute to transition from the first parachute anchoring mode to asecond parachute anchoring mode, wherein the parachute exerts, on theairframe, a second force with a second moment arm defined from the CG;and after controlling the parachute to transition from the firstparachute anchoring mode to the second parachute anchoring mode, landingthe rotorcraft.
 12. The method of claim 11, wherein: operating therotorcraft in the nominal flight mode comprises controlling the rotor torotate about the rotor axis at a first speed greater than a thresholdspeed; and determining the parachute mode transition trigger comprisessampling sensor data indicative of rotor rotation about the rotor axisat a second speed less than the threshold speed.
 13. The method of claim11, wherein: the rotorcraft further comprises a first anchor connectedto the airframe at a first point, a second anchor connected to theairframe at a second point, and a parachute connector; in the firstparachute anchoring mode, the parachute connector connects the parachuteto the first anchor; in the second parachute anchoring mode, theparachute connector connects the parachute to the second anchor; andcontrolling the parachute to transition from the first parachuteanchoring mode to the second parachute anchoring mode comprisesdisconnecting the first anchor from the parachute connector.
 14. Themethod of claim 11, wherein: controlling the rotor to rotate about therotor axis comprises controlling a powerplant of the rotorcraft to driverotation of the rotor; and determining the emergency condition comprisessampling sensor data indicative of failure of the powerplant.
 15. Themethod of claim 11, wherein: the rotorcraft further comprises a rocketengine mechanically coupled to the parachute; and the method furthercomprises, after controlling the parachute to transition from the firstparachute anchoring mode to the second parachute anchoring mode:disconnecting the parachute from the airframe; and firing the rocketengine to propel the parachute away from the airframe.
 16. The method ofclaim 11, wherein: while operating the rotorcraft in the nominal flightmode, the rotorcraft orientation defines a nominal pitch; while in thefirst parachute anchoring mode, the rotorcraft orientation defines afirst mode pitch, wherein the difference between the nominal pitch andthe first mode pitch is greater than a threshold angle; and while in thesecond parachute anchoring mode, the rotorcraft orientation defines asecond mode pitch, wherein the difference between the nominal pitch andthe second mode pitch is less than the threshold angle.
 17. The methodof claim 16, wherein: the threshold angle is greater than 45°; and thedifference between the nominal pitch and the second mode pitch is lessthan 15°.
 18. The method of claim 11, wherein performing emergencycountermeasures further comprises, at a rocket engine mechanicallyconnected to the airframe, exerting a rocket force on the airframe,wherein the rocket force is oriented upward relative to a gravityvector.
 19. The method of claim 18, wherein exerting the rocket forcecomprises, before deploying the parachute, firing the rocket engine. 20.The method of claim 18, wherein exerting the rocket force comprises,after controlling the parachute to transition from the first parachuteanchoring mode to the second parachute anchoring mode and before landingthe rotorcraft, firing the rocket engine.